Hi Eva, > ... Is it a > problem with Zeek like to much data or was the loss already in the pcap and > has nothing to do with Zeek? The loss was already in the pcap. When running on pcaps, Zeek does not drop any packets present in the pcap. Vern